Attribution requirements for dataset reuse

Introduction

Attribution requirements for dataset reuse refer to the legal obligations imposed on individuals, researchers, organisations and commercial entities to acknowledge the original creators, owners or sources of datasets when using, reproducing, modifying, distributing or incorporating those datasets into new projects.

Datasets are widely used in artificial intelligence, machine learning, scientific research, academic publications, healthcare, financial analysis and commercial software development. They may contain photographs, text, statistical information, scientific observations, geographical records, research findings and other forms of information.

The legal requirements for attribution depend on the nature of the dataset, the applicable copyright law, contractual restrictions, database rights and the licence under which the dataset is made available.

Attribution is particularly important when datasets are reused for commercial purposes or incorporated into artificial intelligence training systems. Failure to comply with applicable attribution requirements may result in copyright infringement, breach of contract or violation of licensing conditions.

Legal foundations of dataset attribution

Attribution requirements are primarily derived from copyright law, licensing agreements, database protection laws and contractual obligations.

1. Copyright protection

Copyright protects original expressions rather than facts, ideas or information as such.

A dataset may contain individual copyrighted works, including photographs, articles, illustrations, software code and creative research materials. Reusing these materials without satisfying applicable copyright requirements may constitute infringement.

Under the Copyright Act, 1957, India recognises copyright protection for original literary, dramatic, musical and artistic works, as well as certain other categories.

Section 13 identifies the categories of works in which copyright subsists.

Section 14 defines the exclusive rights associated with copyright ownership.

Section 51 addresses copyright infringement.

Section 57 recognises the author's special rights, including the right to claim authorship and to restrain or claim damages for certain prejudicial distortions or modifications of a work.

Therefore, when a dataset contains copyright-protected material, attribution obligations may arise from the applicable licence or contractual arrangement.

2. Database protection

Database protection differs across jurisdictions.

In India, databases may receive copyright protection as compilations where the required originality exists.

Section 2(o) of the Copyright Act, 1957, includes compilations within the definition of literary work.

Section 2(y) defines a work to include literary works and other specified categories.

The protection generally concerns the original selection, coordination or arrangement of data rather than the underlying facts themselves.

In the European Union, Directive 96/9/EC on the legal protection of databases establishes copyright protection for original database structures and a separate sui generis database right for qualifying investments in obtaining, verifying or presenting database contents.

Article 7 provides protection against certain forms of extraction and reutilisation of substantial parts of protected databases.

This distinction is important because even where individual data points are not copyrighted, substantial extraction of a protected database may create legal liability.

Attribution requirements under different dataset licences

Dataset reuse is frequently governed by open licences. These licences permit specified forms of reuse while imposing conditions on users.

1. Creative Commons Attribution (CC BY)

The CC BY licence permits users to share and adapt licensed material, including for commercial purposes, provided that appropriate credit is given.

Users generally need to:

Identify the original creator.

Provide appropriate attribution.

Include the licence reference.

Indicate whether modifications were made.

Avoid suggesting that the original creator endorses the reuse.

2. Creative Commons Attribution-ShareAlike (CC BY-SA)

This licence allows reuse and modification subject to attribution and the requirement that adaptations be distributed under the same or a compatible licence.

It is particularly relevant to collaborative research datasets and educational resources.

3. Creative Commons Attribution-NonCommercial (CC BY-NC)

This licence permits reuse for non-commercial purposes, subject to attribution.

Commercial exploitation requires additional permission where the activity falls outside the licence.

4. Creative Commons Attribution-NoDerivatives (CC BY-ND)

This licence permits redistribution under specified conditions but does not permit the distribution of adapted material.

A user cannot assume that attribution alone authorises modification or redistribution.

5. Open Data Commons licences

Open Data Commons provides specialised licences for database reuse.

Important examples include:

ODC Attribution License (ODC-By): Requires attribution when sharing, creating or adapting databases under its conditions.

ODbL: Requires attribution and imposes share-alike obligations for certain derivative databases.

Public Domain Dedication and Licence (PDDL): Dedicates qualifying database rights to the public domain to the extent legally possible.

International legal framework

1. Berne Convention for the Protection of Literary and Artistic Works, 1886

The Berne Convention establishes international standards for copyright protection.

Article 6bis recognises the author's moral rights, including the right to claim authorship and object to certain prejudicial modifications of a work.

Article 5 establishes important principles concerning national treatment and copyright protection in other member countries.

These provisions are relevant when datasets contain copyright-protected creative material and are reused internationally.

2. Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS), 1994

Article 10(2) of TRIPS specifically addresses the protection of compilations of data or other material.

It provides that compilations, whether in machine-readable or other form, which constitute intellectual creations because of the selection or arrangement of their contents, shall be protected as intellectual property.

However, such protection does not extend to the data or material itself.

This distinction is fundamental to determining whether attribution is required for dataset reuse.

3. WIPO Copyright Treaty, 1996

The WIPO Copyright Treaty strengthens international copyright protection in the digital environment.

Article 5 addresses the protection of compilations of data or other material where their selection or arrangement constitutes an intellectual creation.

It does not extend copyright protection to the underlying data itself.

4. General Data Protection Regulation (GDPR), 2016

The GDPR is relevant where datasets contain personal information.

Article 5 establishes principles including transparency, purpose limitation, data minimisation and accuracy.

Article 6 establishes the legal bases for processing personal data.

Article 14 establishes transparency requirements where personal data have not been obtained directly from the data subject.

However, GDPR transparency obligations should not be confused with copyright attribution requirements. Giving credit to a dataset creator does not automatically make the processing of personal data lawful.

Indian legal framework governing dataset reuse

India does not have a single comprehensive law specifically regulating attribution requirements for all datasets. Several existing laws provide relevant protections.

1. Copyright Act, 1957

The Copyright Act is the principal legislation governing copyright protection for original datasets and compilations.

Its relevant provisions include:

Section 13: Works in which copyright subsists.

Section 14: Meaning of copyright.

Section 17: First ownership of copyright.

Section 30: Licences by copyright owners.

Section 51: Copyright infringement.

Section 57: Author's special rights.

Where a dataset qualifies as an original literary compilation, its protected selection or arrangement cannot be freely reproduced without satisfying the applicable legal requirements.

2. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023, establishes a framework for processing digital personal data in India.

It is relevant when reused datasets contain identifiable personal information.

Its requirements concerning lawful processing, consent or other applicable statutory grounds, notice and data fiduciary responsibilities must be considered.

Attribution does not replace compliance with personal data protection obligations.

3. Information Technology Act, 2000

The Information Technology Act provides a legal framework for electronic records, digital activities and certain forms of computer-related offences.

Section 43 addresses specified unauthorised acts involving computer systems and data, while Section 66 deals with certain acts under Section 43 when committed dishonestly or fraudulently.

Its application depends on the specific conduct and statutory requirements. Ordinary dataset reuse is not automatically an offence under these provisions.

Important case laws and judicial decisions

There are relatively few reported judgments dealing specifically with attribution requirements for modern machine-learning datasets. However, several important decisions establish principles relevant to dataset ownership, originality, database protection and reuse.

1. Eastern Book Company v. D.B. Modak (2008)

The Supreme Court of India examined copyright protection in judicial judgments and the originality required for copyright in edited legal publications.

The Court adopted a standard requiring a minimum degree of creativity rather than mere labour or skill.

Legal significance: A dataset's compilation or arrangement may receive copyright protection where it demonstrates sufficient originality. Merely collecting factual information does not automatically create copyright in every underlying data point.

2. Burlington Home Shopping Pvt. Ltd. v. Rajnish Chibber (1995)

The Delhi High Court considered copyright protection in a compilation of customer information.

The case addressed the protection of compilations and the commercial value of organised information.

Legal significance: The judgment is relevant to commercial databases because original compilations may receive copyright protection. Reusing protected database material without appropriate authorisation may create legal liability.

3. Feist Publications, Inc. v. Rural Telephone Service Co. (1991)

The United States Supreme Court considered whether a telephone directory containing names, addresses and telephone numbers qualified for copyright protection.

The Court held that factual information itself is not protected by copyright and that a compilation must demonstrate a minimum level of originality in selection or arrangement.

Legal significance: The decision establishes an important distinction between facts and original database structures. Attribution requirements cannot automatically be imposed through copyright law on every reuse of factual information.

4. Football Dataco Ltd v. Yahoo! UK Ltd (2012)

The Court of Justice of the European Union examined copyright protection for football fixture lists under the EU Database Directive.

The Court held that copyright protection requires intellectual creation through the selection or arrangement of data and cannot be established merely through significant labour or skill.

Legal significance: The case clarifies that database copyright depends on originality rather than the amount of investment involved in collecting information.

5. Ryanair Ltd v. PR Aviation BV (2015)

The Court of Justice of the European Union considered the reuse of information obtained from an airline's website where the database did not qualify for protection under the Database Directive.

The Court examined whether contractual restrictions could nevertheless govern the relationship between the parties.

Legal significance: The judgment demonstrates that dataset reuse may be restricted through contractual terms even where statutory database protection is unavailable.

6. CCH Canadian Ltd. v. Law Society of Upper Canada (2004)

The Supreme Court of Canada examined originality in copyright law and considered the protection of legal materials and compilations.

The Court explained that originality requires an exercise of skill and judgment that is not purely mechanical.

Legal significance: The decision provides guidance on determining whether a dataset's selection or arrangement qualifies for copyright protection.

Attribution obligations in artificial intelligence and machine learning

Dataset attribution has become particularly important in artificial intelligence development.

AI developers frequently use large datasets containing text, images, audio, scientific information and publicly accessible online materials.

However, the fact that a dataset is publicly available does not automatically mean it is free from copyright or licensing restrictions.

Developers should examine the following requirements:

Identify the original dataset publisher and relevant contributors.

Verify the applicable licence before downloading or using the dataset.

Preserve copyright notices and attribution statements.

Record the source and version of the dataset.

Identify modifications, cleaning and transformations.

Maintain records of permissions and licensing conditions.

Check whether commercial AI training is permitted.

Ensure compliance with applicable personal data protection requirements.

For example, if a research organisation uses a CC BY dataset to train a machine-learning model, it must comply with the licence's attribution requirements when sharing or otherwise using the licensed material in ways covered by the licence. Whether distributing the trained model itself triggers attribution or other obligations depends on the nature of the use and the licence terms.

Legal consequences of non-compliance

Failure to comply with dataset attribution requirements may result in several legal consequences.

Copyright infringement: Reproduction or distribution of protected dataset material without authorisation may violate copyright law.

Breach of contract: Ignoring contractual restrictions or licence conditions may result in contractual liability.

Database rights infringement: Substantial extraction or reutilisation of a protected database may violate applicable database rights.

Academic misconduct: Failure to acknowledge research datasets may result in plagiarism allegations, publication corrections or institutional disciplinary action.

Privacy violations: Reusing personal information without satisfying applicable data protection requirements may lead to regulatory consequences.

Conclusion

Attribution requirements for dataset reuse are an important component of modern intellectual property and data governance law. They ensure recognition of original creators, protect qualifying database compilations and establish responsible standards for academic, scientific and commercial data reuse.

International frameworks such as the Berne Convention, TRIPS Agreement and WIPO Copyright Treaty provide important foundations for copyright protection. In India, the Copyright Act, 1957, is particularly relevant to original datasets and compilations, while the Digital Personal Data Protection Act, 2023, addresses separate obligations involving personal data.

Judicial decisions such as Eastern Book Company v. D.B. Modak, Burlington Home Shopping v. Rajnish Chibber and Feist Publications v. Rural Telephone Service clarify the distinction between factual information and copyright-protected compilations.

Ultimately, lawful dataset reuse requires more than simply mentioning the original source. Users must examine the applicable licence, respect copyright and database rights, preserve required attribution information and comply with relevant contractual and data protection obligations.